In the Linux kernel's ALSA sequencer, the bounce_error_event() routine sent a fixed‑length SNDRV_SEQ_EVENT_KERNEL_ERROR event to all clients, with the data.quote.event field containing an unfiltered raw kernel heap pointer. The pointer was copied to user space via copy_to_user(), leaking sensitive kernel memory addresses—a data‑exposure flaw identified as CWE‑212. While it does not grant immediate privilege escalation, revealing kernel pointers can assist attackers in crafting subsequent attacks that exploit other kernel vulnerabilities.

All Linux kernel implementations that ship the default ALSA sequencer and have not yet applied the patch that corrects bounce_error_event() are affected. This includes every vendor distribution based on the upstream Linux kernel prior to the indicated commit; the vulnerability is present across all aliases listed as Linux:Linux in the CNA data.

With a CVSS score of 5.5, indicating moderate severity, the vulnerability is not listed in CISA KEV and the EPSS indicates a probability of less than 1 %, implying a very low likelihood of widespread exploitation. An attacker would have to invoke an ALSA client that triggers a bounce error, then read the kernel heap address via snd_seq_read(). Although the leak alone does not enable code execution, the disclosed address could facilitate a separate, pointer‑based kernel exploit. Overall, the risk is low to moderate, warranting mitigation in environments with high security requirements.